What is DCC(Detached credential collector) in OAM ??

Hello friends, Recently I came across the requirement for Detached credential collector in OAM 11.1.2.3. So I  started configuring it with a sample application to understand how it works.  In my blog, I will also post about the configuration changes required for DCC.

Before we get started with these configurations, It is better to understand the main difference between the DCC and ECC(Embedded credential collector) which are supported by OAM. The major difference is way the credentials are submitted to OAM server for the validation. 

How ECC Works:

• Embedded credential collector(ECC) engine is used for capturing the user credentials submitted which is embedded/deployed inside OAM application server from an external agent like user browser etc. So ECC services runs on application layer.
• In ECC mechanism, user submits the credentials on the login form which will be submitted directly to OAM Server over web i.e., user credentials are submitted to OAM Server from user browser agent to OAM server running in the middle tier/App layer through a proxy over HTTP/HTTPS. You can still secure this communication by adding SSL layer but most of the people doesn't like to expose their app layer contexts.

How DCC Works:

• In DCC mechanism, user submits the credentials on the login form which is deployed in DMZ served by DCC webgate and webgate will also takes care of submitting these credentials to OAM server through OAP communication. This OAP communication is backend channel communication happens between the webgate and OAM server. 

              So comparatively DCC is more secured mechanism while handling the user credential communication between  User browser agent and OAM servers. DCC supports almost all the features which ECC supports except a few like Challenge methods. DCC supports only Basic/form based authentications where as ECC supports many other ways of challenge mechanisms. As long as you are using the Form based mechanism for user authentications, DCC is the more secure way to use.

             Also there are several other differences between this ECC and DCC which are very well documented here.

      After going through above link, you will have a better understanding on the way how these credential collectors work in OAM and differences between these two mechanisms.

My blog post on how to configure DCC in OAM 11.1.2.3 is here...

Thanks you for visiting.

Multi factor authentication with OAM alone !! [Part-2]

• Now lets configure the 'AdativeAuthenticationPlugin' 
• Click on 'Application Security' and  navigate to authentication plugins

• Search for 'AdaptiveAuthenticationPlugin' and select the plugin

 

• Update the below details as shown. These details will be same as what we have updated in the authentication module

 

 

 

• Now click on Save to update the changes and click on 'Activation State' to make sure it is activated on the managed server.

 
Note: In this step, there might be issue sometimes in activating this Plugin . Reported error message would be ''Action failed due to inconsistent status of plugin in different managed servers". Refer to my other post on the fix for this issue.

• Once the plugin is activated, Lets configure the authentication policy 
• Navigate to 'Applciation security' -> Application domain 
• Search for authentication policy that protected the our sample html file.
• Click on Advanced Rules -> Post authentcation. Add the new rule 

• This is the step where we redirect the user to additional authentication by configuring the below rule which always evaluates to true.
• Add the rule as shown below and click on 'Add' to apply this rule.

 

• Click on Apply to save this updated authentication policy.

 

•  Now we have completed the configurations and lets validate the scenario.

Validation:

• Lets make sure we have a user profile in OUD with mail populated with a valid email.

 

• Now access the protected url in my case it is 
  
• http://OHShost:OHSPort/test/test.html  
•  Authenticate with username and password which is initial authentication step.

 

• Once initial authentication is successful, you will be redirected to OTP screen which is additional step of authentication
•  You can select OTP-> your email address and click on OTP. This will send an OTP code to the email address that is retrieved from UserIdentity store1

• Enter the OTP received and click on Login button

• That's all. You are now authenticated successfully through multi factor authentication which is One Time Pin(OTP) received through email

You can also refer to following links in case of any issues mentioned in below links.

• OAM Plugin activation failed 
• Adaptive Authentication Plugin fails with java.lang.NullPointerException

Thank you for visiting.

Multi factor authentication with OAM alone !! [Part-1]

                  In this post, We are going to look the Adaptive authentication service that was introduced in the latest version of OAM Patch Set-3. Earlier to OAM 11gR2 PS3 version, multi factor authentication/step-up authentication for an application can be configured with the help of Oracle Adaptive Access manager which is separate component from Oracle Access Management suite or by going through approach of customizing the authentication flow. But you no longer need to install OAAM or go through customization effort to achieve the requirement of multi factor authentication. In OAM PS3, Adaptive authentication service provides this second factor authentication possibilities in various ways as mentioned below.

• One Time Pin(OTP) through Email/SMS/Mobile authenticator
• Access request notification from mobile authenticator 

However you will have to make use of Oracle adaptive access manager(OAAM) for various other features like Risk analysis, Fraud prevention, KBA and many others. In today's post, we are going to cover the implementation steps for enabling OTP through email.   

           

Environment:

• OAM 11.1.2.3 BP07
• RHEL6/OL6
• OUD 11.1.2.3
• OHS 11.1.1.7 with OAM Webgate 11.1.2
• SOA 11.1.1.9

Assumptions:

• OAM 11.1.2.3 installed and configured
• Sample html page deployed on OHS is protected by OAM through OOB LDAPScheme
• OUD is configured as authentication store for OAM
• SOA User Messaging Server(UMS) configured with email provider

Steps:  

• Login to OAM console and navigate to Configuration
• Click on Available services
• Click on Enable and make sure Adaptive Authentication Service is enabled

 

• Go to Application security and navigate to Authentication modules  
• Search for the 'AdaptiveAuthenticationModule' as shown

•  Click on 'AdaptiveAuthenticationModule' and go to steps. Select the 'SecondFactorOTP' stepname

• Make sure you update the following fields with relevant value
• EmailMsgSubject : This would be subject of OTP email that user receives
• EmailField: LDAP attribute name from which email value is retrieved('mail' in case OUD)
• Email_Enabled: Set to true for enabling OTP through email communication
• UmsClientUrl: URL of SOA UMS service which sends email to the user
• UmsAvailable: Set to true
• IdentityStoreRef: Name of UserIdentityStore configured in OAM as authentication repository. 

  

•  Click on Save to update the configuration and then click on Apply

  

To be continued in Part-2...